Lessons from the DaVita Healthcare Ransomware Attack
The DaVita ransomware attack is one of the most impactful recent healthcare breaches. Learn what happened and what could have been done to limit the impact.
Healthcare Penetration Testing
You can tell when it’s real. One hospital was sure we couldn’t reach its medical device network. Then there we were.
EHR & Clinical System Testing
Electronic health record platforms, clinical workflows, and the access controls protecting ePHI.
Medical Device & IoMT Security
Connected medical devices, firmware, communications protocols, and authentication mechanisms.
HIPAA & HITECH Compliance Validation
Every engagement maps to the HIPAA Security Rule and NIST SP 800-66, built for what OCR expects today.
Scanners Miss Clinical Context
Automated tools flag CVEs. They don’t see how a misconfigured EHR access control lets a billing clerk view oncology records, or how an unpatched imaging system becomes a pivot into the clinical network.
Medical Devices Get Skipped
Infusion pumps, imaging systems, and IoMT devices run legacy firmware with weak authentication and insecure protocols, and most vendors leave them out of scope.
Telemedicine Is an Afterthought
Video consultation platforms, remote diagnostic tools, and patient portal integrations all handle ePHI. If your vendor skips the telemedicine layer, you have a gap.
Third-Party Access Goes Untested
Some of the largest healthcare breaches start with a vendor or business associate. Raxis tests the third-party connections, remote vendor access, and integrations that reach ePHI.
Why Raxis for Healthcare Penetration Testing
Real Clinical Risk
OSCP-certified engineers attack your environment the way real threat actors do, so findings show how patient data could actually be exposed.
Compliance-Ready Reports
Real skill leaves evidence: context, real-world impact, and prioritized remediation for every finding, delivered through the secure Raxis One portal and structured for HIPAA Security Rule alignment.
No Disruption to Care
Rules of engagement built for healthcare preserve data integrity, system availability, and clinical operations. No downtime, no risk to patient safety.
Controls Proven Under Attack
We test whether HIPAA and HITECH controls work, not whether they exist: unauthorized access to patient records, lateral movement across clinical networks, and exploitation of ePHI systems.
The Full Attack Surface
EHR platforms, patient portals, telemedicine systems, medical devices, internal and external networks, wireless infrastructure, and third-party integrations, tested end-to-end.
Coverage Between Assessments
Annual testing is the baseline. Raxis Attack (PTaaS) adds continuous, AI-assisted testing, real-time results, and unlimited retesting through Raxis One.
From Our Engineers: Healthcare
Written by the Raxis engineers who run these tests, from real engagements and research.
Why We Always Harp on Healthcare
Healthcare security may start with HIPAA regulations, but, in the end, it all comes down to protecting patients and the healthcare workers.
When There’s More than Money on the Line
Raxis’ COO, Bonnie Smyre, has a conversation with Atlanta-area nurse Judy Chang about the potential impacts of healthcare breaches.
FAQ: Healthcare Penetration Testing
What is healthcare penetration testing?
A hands-on simulated attack on the clinical systems, networks, applications, and medical devices that store, process, or transmit ePHI. It proves your controls hold under the HIPAA Security Rule and validates your HIPAA risk analysis in practice, though it does not replace the documented risk analysis HIPAA requires.
What systems does Raxis test in a healthcare engagement?
EHR systems, patient portals, telemedicine platforms, medical devices and IoMT infrastructure (firmware, communications, authentication), internal and external networks, wireless networks, web applications, APIs, and third-party and business associate connections, including remote vendor access. Every engagement aligns with the HIPAA Security Rule and NIST SP 800-66.
Will testing disrupt clinical operations or risk patient safety?
No. Raxis works within strict contractual boundaries and rules of engagement designed for healthcare, exposing vulnerabilities without downtime, data loss, or interruption to patient care.
How often should healthcare organizations perform penetration testing?
At least annually and after significant changes such as EHR migrations, infrastructure updates, or new system deployments. The HIPAA Security Rule requires risk-based evaluation, not a fixed schedule; a proposed update would make annual testing explicit but is not yet final. Continuous coverage is available through Raxis Attack.
What happens to ePHI and our findings after the test?
ePHI and other sensitive data is redacted before it is stored, so nothing critical leaves your environment or is retained by Raxis. Findings are delivered through the secure Raxis One portal and stored in SOC 2 Type II compliant infrastructure. We don't share client data with third parties, any third party supporting an engagement signs a nondisclosure agreement, and we use AI tools only where the provider commits not to train on your data.